CVE-2026-26166

CVE-2026-26166 is a double free vulnerability in Windows Shell that permits authorized local users to escalate their privileges on affected systems. The flaw requires local access and moderate technical complexity to exploit, but if successful, grants attackers high-impact capabilities including confidentiality, integrity, and availability compromises. The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a local attack vector and low privilege requirement, indicating that authenticated users with standard permissions can trigger the exploit. The associated EPSS score of 0.00045 suggests minimal real-world exploitation probability relative to the broader CVE ecosystem, placing this vulnerability below the 0.139th percentile for exploitation likelihood. Current exploitation indicators remain limited, with no active KEV listing and an inactive status on threat hot lists, indicating no widespread or coordinated attacks have been observed. The FAUCET risk score of 37.0/100 reflects moderate concern, though the lack of public exploit code availability and minimal community attention suggest this remains a localized threat requiring proactive patching rather than emergency response.